fix(coderd/provisionerdserver): ensure that SidebarAppID is a known workspace app

johnstcn · johnstcn · commit 4e34c89bc6d9 · 2025-08-02T17:46:35.000+01:00
diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
@@ -1943,6 +1943,17 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 			}
 		}
 
+		var knownAppIDs []string
+		for _, res := range jobType.WorkspaceBuild.Resources {
+			for _, agt := range res.Agents {
+				for _, app := range agt.Apps {
+					if app.Id == "" {
+						continue
+					}
+					knownAppIDs = append(knownAppIDs, app.Id)
+				}
+			}
+		}
 		var sidebarAppID uuid.NullUUID
 		hasAITask := len(jobType.WorkspaceBuild.AiTasks) == 1
 		if hasAITask {
@@ -1959,18 +1970,33 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 			sidebarAppID = uuid.NullUUID{UUID: id, Valid: true}
 		}
 
+		// NOTE(Cian): If stopping a workspace build, we must ensure that the
+		// SidebarAppID corresponds to an extant coder_app. If it does not, the
+		// build will fail with a foreign key constraint violation as workspace_builds.ai_task_sidebar_app_id
+		// references coder_apps.id.
+		// Unfortunately, this behavior will result in the workspace build being
+		// 'silently' not configured as an AI task except for a warning in the logs.
+		// Ideally, we should also accept an app slug as these are less likely to change.
+		if sidebarAppID.Valid && !slices.Contains(knownAppIDs, sidebarAppID.UUID.String()) {
+			s.Logger.Warn(ctx, "workspace build has unknown sidebar app ID",
+				slog.F("workspace_build_id", workspaceBuild.ID),
+				slog.F("sidebar_app_id", sidebarAppID),
+				slog.F("known_app_ids", knownAppIDs),
+			)
+			sidebarAppID = uuid.NullUUID{}
+			hasAITask = false
+		}
 		// Regardless of whether there is an AI task or not, update the field to indicate one way or the other since it
 		// always defaults to nil. ONLY if has_ai_task=true MUST ai_task_sidebar_app_id be set.
-		err = db.UpdateWorkspaceBuildAITaskByID(ctx, database.UpdateWorkspaceBuildAITaskByIDParams{
+		if err = db.UpdateWorkspaceBuildAITaskByID(ctx, database.UpdateWorkspaceBuildAITaskByIDParams{
 			ID: workspaceBuild.ID,
 			HasAITask: sql.NullBool{
 				Bool:  hasAITask,
 				Valid: true,
 			},
 			SidebarAppID: sidebarAppID,
 			UpdatedAt:    now,
-		})
-		if err != nil {
+		}); err != nil {
 			return xerrors.Errorf("update workspace build ai tasks flag: %w", err)
 		}
 
diff --git a/coderd/provisionerdserver/provisionerdserver_test.go b/coderd/provisionerdserver/provisionerdserver_test.go
@@ -2794,6 +2794,20 @@ func TestCompleteJob(t *testing.T) {
 					},
 					expected: true,
 				},
+				{
+					name: "non-existing app",
+					input: &proto.CompletedJob_WorkspaceBuild{
+						AiTasks: []*sdkproto.AITask{
+							{
+								Id: uuid.NewString(),
+								SidebarApp: &sdkproto.AITaskSidebarApp{
+									Id: uuid.NewString(), // Non-existing app ID.
+								},
+							},
+						},
+					},
+					expected: false,
+				},
 			} {
 				t.Run(tc.name, func(t *testing.T) {
 					t.Parallel()
